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1 . (Currently Amended) A method of automatically identifying anomalous situations during 
system operations , said method comprising: 

recording actions performed by a said system as features in a history file; 

automatically creating a model for each feature only from normal data in said history file; 

performing te araiag determining by calculating anomaly scores of said features to 
produce a trained file : 

establishing a threshold to evaluate whether features are abnormal; 
automatically identifying abnormal actions of said system based on said anomaly scores 
and said threshold; and 

periodically repeating saad^rai amg proooGO said determining, wherein said abnormal 
actions indicate anom alous situations during system op eration. 

2. (Currently Amended) The method in claim 1 , wherein said proc e ss of creating a said 
model for said each feature comprises: 

establishing relationships that exist between said each features for normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
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each remaining feature as models for the remaining features. 

3 . (Original) The method in claim 2, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

4. (Original) The method in claim 2, wherein said normal system operations comprise said 
features in said history file at the time said models are created. 

5. (Currently Amended) The method in claim 1, wherein said training determining 
comprises: 

predicting the a likelihood that said each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce a said trained file of a plurality of anomaly scores for each of said 
features. 

6. (Original) The method in claim 5, wherein said trained file provides an normally score 
for each of said features for each of a plurality of different possible abnormalities. 

7. (Currently Amended) The method in claim 5, wherein said process of automatically 
identifying abnormal actions comprises: 
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determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said features; 
comparing said anomaly score for each of said features with, said threshold to determine 
whether each anomaly score exceeds said threshold, 

8. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations, said method comprising: 

recording actions performed by a system as features in a history file; 

automatically creating a model for each feature only from normal data in said history file; 

pe rforming tro iaaftg determining by calculating anomaly scores of said features to 
produce a trained file: 

establishing a threshold to evaluate whether features axe abnormal; 

automatically identifying abnormal actions of said system based on said anomaly scores 
and said threshold; and 

periodically repeating said determining training process , wherein said abnormal actions 
indicate a nomalous situations during system operation: 

wherein said proc e ss of creating a said model for said each feature comprises: 

establishing relationships that exist between said each features for normal system 

operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said 
labeled feature to create a solution for said labeled feature, wherein said solution comprises a 
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model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

9. (Original) The method in claim 8, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

1 0. (Original) The method in claim 8, wherein said normal system operations comprise said 
features in said history file at the time said models are created. 

1 1 . (Currently Amended) The method in claim 8, wherein said training determining 
comprises: 

predicti ng the a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using difFerent presumptions about other features being normal 
and abnormal to produce a said trained file of a plurality of anomaly scores for each of said 
features. 

1 2 . (Original) The method in claim. 1 1 , wherein said trained file provides an normally score 
for each of said features for each of a plurality of different possible abnormalities. 
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13. (Currently Amended) The method in claim 1 1 , wherein said proc e ss of automatically 
identifying abnormal actions comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said features; 
comparing said anomaly score for each of said features with said threshold to determine 
whether each anomaly score exceeds said threshold. 

14. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations, said method comprising; 

recording actions performed by sakl a system as features in a history file; 

automatically creating a model for each feature only from normal data in said history file; 

p e rforming training by calculating anomaly scores of said features to produce a trained 

file ; 

establishing a threshold to evaluate whether features are abnormal; 

automatically identifying abnormal actions of said system based on said anomaly scores 
and said threshold; and 

periodically repeating said determining draining process , wherein said abnormal actions 
indicate anomalous situations during system operations: 

wherein said training comprises: 

predicting Ae a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
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and abnormal to produce a said trained file of a plurality of anomaly scores for each of said 
features. 

15. (Currently Amended) The method in claim 1 4, wherein said procoos of creating a said 
model for each said feature comprises: 

establishing relationships that exist between said each features for normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

1 6. (Original) The method in claim 15, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

17. (Original) The method in claim 15, wherein said normal system operations comprise said 
features in said history file at the time said models are created. 
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18. (Original) The method in claim 14, wherein said trained file provides a normally score 
.for each of said features for each of a plurality of different possible abnormalities. 

1 9. (Currently Amended) The method in claim 14, wherein said proc e ss of automatically 
identifying abnormal actions comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said features; 
comparing said anomaly score for each of said features with said threshold to determine 
whether each anomaly score exceeds said threshold. 

20. (Currently Amended) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform a method of 
automatically identifying anomalous situations during system operations, said method 
comprising: 

recording actions perfomied by saki a system as features in a history file; 

automatically creating a model for said each feature only from normal data in said history 

file; 

performing training by calculating anomaly scores of said each features; 
establishing a threshold to evaluate whether features are abnormal; 
automatically identifying abnormal actions of said system based on said anomaly scores 
and said threshold; and 

periodically repeating said determining training process , wherein said abnormal actions 
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indicate anomalous situations during system operations. ° 

21 . (Currently Amended) The program storage device in claim 20, wherein $aid method 
further comprises a process of creating a model for said each feature comprises: 

establishing relationships that exist between said each features for normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

22. (Original) The program storage device in claim 2 1 b wherein said method further 
comprises a mathematical statement of what said labeled feature equals in terms of the 
relationships between the remaining features. 

23. (Original) The program storage device in claim 21 7 wherein said normal system 
operations comprise said features in said history file at the time said models are created, 

24. (Currently Amended) The program storage device in claim 20, wherein said rearranging 
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ttaia Mig m e thod further comprises: 

predicting tfee a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being nornial 
and abnormal to produce a said trained file of a plurality of anomaly scores for each of said 
features, 

25. (Original) The program storage device in claim 24, wherein said trained file provides an 
normally score for each of said features for each of a plurality of different possible abnormalities, 

26. (Currently Amended) The program storage device in claim 24, wherein said 
automatically proc e ss of identifying abnormal actions further comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said features; 
comparing said anomaly score for each of said features with said threshold to determine 
whether each anomaly score exceeds said threshold. 
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